Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Address OSS Fuzz Issues #1268

Merged

Conversation

kdt3rd
Copy link
Contributor

@kdt3rd kdt3rd commented Jul 10, 2022

Address:
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47483
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47503
https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=47517

There was a set of issues when the y sampling of a file was odd and not 1 (as in not even, not just bogus), and further memory issues decoding very small files (i.e. width of 1)

kdt3rd added 5 commits July 10, 2022 18:17
Add location to extract internal helper functions to reduce code
duplication

Signed-off-by: Kimball Thurston <[email protected]>
Use new compute_sampled_lines when the y_sampling is odd (sampling % 2
== 1), where the number of lines per chunk will oscillate.

Signed-off-by: Kimball Thurston <[email protected]>
Use a minimum size to handle that b44 is always 4x4 blocks

Signed-off-by: Kimball Thurston <[email protected]>
use the scratch buffer size instead of decompressed buffer size, allow
some extra padding in scratch buffer when appropriate

Signed-off-by: Kimball Thurston <[email protected]>
Copy link
Contributor

@meshula meshula left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This all looks good to me, and consolidating the check logic also looks like a general improvement.

int64_t chunk = (int64_t) leader.scanline_y;
chunk -= (int64_t) part->data_window.min.y;
chunk /= part->lines_per_chunk;
if (chunk < 0 || chunk > INT32_MAX)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I assume the INT32_MAX (as opposed to another constant) is consistent with the rest of the implementation of the core?

@cary-ilm cary-ilm merged commit 7629dad into AcademySoftwareFoundation:main Jul 31, 2022
cary-ilm pushed a commit to cary-ilm/openexr that referenced this pull request Mar 3, 2023
* Add utility function header

Add location to extract internal helper functions to reduce code
duplication

Signed-off-by: Kimball Thurston <[email protected]>

* Fix issues with odd y_sampling numbers

Use new compute_sampled_lines when the y_sampling is odd (sampling % 2
== 1), where the number of lines per chunk will oscillate.

Signed-off-by: Kimball Thurston <[email protected]>

* Fix integer overflow computing deep chunk index

Signed-off-by: Kimball Thurston <[email protected]>

* Fix decompression scratch buffer size

Use a minimum size to handle that b44 is always 4x4 blocks

Signed-off-by: Kimball Thurston <[email protected]>

* Use appropriate buffer size when decompressing

use the scratch buffer size instead of decompressed buffer size, allow
some extra padding in scratch buffer when appropriate

Signed-off-by: Kimball Thurston <[email protected]>
cary-ilm pushed a commit that referenced this pull request Mar 5, 2023
* Add utility function header

Add location to extract internal helper functions to reduce code
duplication

Signed-off-by: Kimball Thurston <[email protected]>

* Fix issues with odd y_sampling numbers

Use new compute_sampled_lines when the y_sampling is odd (sampling % 2
== 1), where the number of lines per chunk will oscillate.

Signed-off-by: Kimball Thurston <[email protected]>

* Fix integer overflow computing deep chunk index

Signed-off-by: Kimball Thurston <[email protected]>

* Fix decompression scratch buffer size

Use a minimum size to handle that b44 is always 4x4 blocks

Signed-off-by: Kimball Thurston <[email protected]>

* Use appropriate buffer size when decompressing

use the scratch buffer size instead of decompressed buffer size, allow
some extra padding in scratch buffer when appropriate

Signed-off-by: Kimball Thurston <[email protected]>
@cary-ilm cary-ilm added the v3.1.6 label Jul 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants